{"id":"CVE-2023-45317","aliases":["EUVD-2023-49611","GHSA-f6g6-wgf5-4jm6"],"status":"published","title":"Sielco Radio Link and Analog FM Transmitters Cross-Site Request Forgery","description":"The application interface allows users to perform certain actions via \nHTTP requests without performing any validity checks to verify the \nrequests. This can be exploited to perform certain actions with \nadministrative privileges if a logged-in user visits a malicious web \nsite.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0029,"percentile":0.21763,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2023-10-26T16:17:37Z","modified":"2026-06-17T06:28:37Z","products":[{"vendor":"sielco","product":"analog fm transmitter"},{"vendor":"sielco","product":"analog_fm_transmitter_exc1000gt_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc1000gx_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc100gt_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc120gt_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc120gx_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc1600gx_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc2000gx_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc3000gx_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc300gt_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc300gx_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc30gt_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc5000gt_firmware"},{"vendor":"sielco","product":"analog_fm_transmitter_exc5000gx_firmware"},{"vendor":"sielco","product":"radio link"},{"vendor":"sielco","product":"radio_link_exc19_firmware"},{"vendor":"sielco","product":"radio_link_rtx19_firmware"}],"references":[{"url":"https://www.cisa.gov/news-events/ics-advisories/icsa-23-299-08","tags":["x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://www.sielco.org/en/contacts","tags":["x_transferred","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45317"},{"url":"https://github.com/advisories/GHSA-f6g6-wgf5-4jm6"}],"sources":{"cve":[{"id":"CVE-2023-45317","title":"Sielco Radio Link and Analog FM Transmitters Cross-Site Request Forgery","description":"\nThe application interface allows users to perform certain actions via \nHTTP requests without performing any validity checks to verify the \nrequests. This can be exploited to perform certain actions with \nadministrative privileges if a logged-in user visits a malicious web \nsite.\n\n\n\n","status":"published","published":"2023-10-26T16:17:37.365Z","modified":"2025-01-16T21:28:15.955Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49611","description":"\nThe application interface allows users to perform certain actions via \nHTTP requests without performing any validity checks to verify the \nrequests. This can be exploited to perform certain actions with \nadministrative privileges if a logged-in user visits a malicious web \nsite.\n\n\n\n","status":"published","published":"2023-10-26T16:17:37Z","modified":"2025-01-16T21:28:15Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:18.077485Z"}],"ghsa":[{"id":"GHSA-f6g6-wgf5-4jm6","title":"\nThe application interface allows users to perform certain actions via \nHTTP requests without...","description":"\nThe application interface allows users to perform certain actions via \nHTTP requests without performing any validity checks to verify the \nrequests. This can be exploited to perform certain actions with \nadministrative privileges if a logged-in user visits a malicious web \nsite.\n\n\n\n","status":"published","published":"2023-10-26T18:30:23Z","modified":"2023-11-16T05:04:56Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:55:02.891904Z"}],"nvd":[{"id":"CVE-2023-45317","description":"\nThe application interface allows users to perform certain actions via \nHTTP requests without performing any validity checks to verify the \nrequests. This can be exploited to perform certain actions with \nadministrative privileges if a logged-in user visits a malicious web \nsite.\n\n\n\n","status":"published","published":"2023-10-26T17:15:09.177Z","modified":"2026-06-17T06:28:37.057Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:08:40.004465Z"}]}}